Hacker Newsnew | past | comments | ask | show | jobs | submit | karmakaze's commentslogin

A prime example of poor implementation that comes to mind is MCAS in Boeing 737 Max[0].

[0] https://en.wikipedia.org/wiki/Maneuvering_Characteristics_Au...


Whether or not the information is accurate isn't really the point. It's that it serves as a way to identify you even without cookies. I looked for better websites, the EFF one[0] is informative.

My browser fingerprint was unique among the visitors in the past 45 days.

[0] https://coveryourtracks.eff.org/


> Whether or not the information is accurate isn't really the point. It's that it serves as a way to identify you even without cookies.

Exactly. A few weeks ago, there was an article about the age limit for social media. And everyone was full of criticism on how it affects privacy. But when there is a post about how browser profile serves de facto as a user identifier, then people are "Of course, what's the problem? We all know that, that's the way it has to be".


> Our tests indicate that you have strong protection against Web tracking.

Gotta love Firefox with ublock origin in advanced mode, even without JavaScript disabled so the site worked.


uMatrix + NoScript personally (yes, seems silly, but I find NoScript's UI more convenient for script toggling, while liking uMatrix's fine grained controls)

Did you enable firefox resist fingerprinting? Also maybe letterboxing, which I think is not enabled by that flag by default, and also helps with CSS fingerprinting.


I used to use umatrix, preferred it to ublock origin advanced mode. However, isn't umatrix unsupported?

It hasn't received updates in a good long while, but seems to work fine, for me anyway. Has some rough edges, logging blocks when there's a bunch of redirects is a bit of a pain, making it hard to fix whitelisting in complicated things (like the dozen domains microsoft uses for auth) but apart from that...

(and ofc there's a bunch of forks adding bugfixes, some even relatively recent in activity, but unfortunately none have become the blessed official maintainer)

Did you specifically re-enable javascript? Ublock origin on medium mode blocks all the tracking javascript and I'd think advanced would follow the same basic starting point.

Yeah, didn't work without it.

I got the same in my iPhone using Safari with Firefox Focus installed.

If i run that (or similar sites) multiple times, shouldn't I like.. not be unique each time?

At least in Europe the gdpr still counts, even when you don't use cookies but fingerprinting.

So if you use this information you still need to disclose it and process data in accordance with the law.


In my case, the site reports "The technique is called browser fingerprinting. It is legal everywhere."

It is definitely not legal in Europe, when used to track individual users. The consent pop-ups are not only about cookies.


id still prefer the information be inaccurate. since sites are rude enough to try and track me, the least i can do is feed them unique garbage.

"It doesn't matter that the FUD isn't accurate" Hmm.

I started reading to find out why Yaml? In it's place I found a great post.

One thing though, I loved the "AUTH-1" numbering and the Yaml breaks that into an Auth section, with "1." subsection which I don't like nearly as much, the codification AUTH-1 is more referenceable/searchable.


Ah, I should have said explicitly or provided an example of in the post;

The tooling expects that you refer to each requirement by full ID e.g.

  # admin.AUTH.1

This could also be a cool export/exchange format for Google Docs and the like.

These AI's are exposing bad operating procedures:

> That token had been created for one purpose: to add and remove custom domains via the Railway CLI for our services. We had no idea — and Railway's token-creation flow gave us no warning — that the same token had blanket authority across the entire Railway GraphQL API, including destructive operations like volumeDelete. Had we known a CLI token created for routine domain operations could also delete production volumes, we would never have stored it.

> Because Railway stores volume-level backups in the same volume — a fact buried in their own documentation that says "wiping a volume deletes all backups" — those went with it.

I don't like the wording where it's the Railway CLI fault that didn't give a warning about the scope of the created token. Yes, that would be better but it didn't make the token a person did and saved it to an accessible file.


> Because Railway stores volume-level backups in the same volume — a fact buried in their own documentation that says "wiping a volume deletes all backups" — those went with it.

Is that buried? It seems pretty explicit (although I don’t think I would make delete backups the default behavior).


There's an "Update:" note for a next post on NF4 format. As far as I can tell this is neither NVFP4 nor MXFP4 which are commonly used with LLM model files. The thing with these formats is that common information is separated in batches so not a singular format but a format for groups of values. I'd like to know more about these (but not enough to go research them myself).


I see one version being buying more than you need for volume discounts.


Maybe some enterprise ones. I did a bit on search/chatting and this is a very different thing than a personal VPN. It's for securing actions on a network at a fine-grained level--instead of everyone inside is free to talk, policies are enforced about who (which software agents) can talk to who about what. This level requires Cloudflare to decrypt traffic and apply the customer's policies.


I remember a specific time when someone very knowledgeable on C++ described friend functions (I think it was) and how there was this thing that he was trying to do. After some thought I came up with some abuse of friend functions to do what he needed. He asked me how I came up with it and that's not how they're supposed to be used. I said I went by what a friend function actually does, not caring why it's called such or prescribed uses.

There's a similar principle about the separation of policy and mechanism which never gets enough exposure. Top-down programmers leak high level concerns all the way down so the underlying parts are only good for the one thing, often naming them in the caller's context rather than by what they literally do. A quote I like is that a poet is one who gives many names to the same thing and a mathematician is one who gives one name (mechanism) to many things (policies) -- Henri Poincaré (paraphrased).


"The purpose of a system is what it does" ...and all that jazz


Does the apparent rugpull on the $GAS meme coin[0] qualify?

[0] https://en.wikipedia.org/wiki/Steve_Yegge#Vibe_coding_and_cr...


Getting sucked into a crypto scam and then deciding to get out, despite the death threats(!)[1] is not a rug pull.

To be clear, the BAGS scam coin he got sucked into is a extractive zero-sum game where someone else creates a coin named after him, offers him trading commission to talk about it and then makes money off the hype.

He did the correct thing by leaving.

(I worked for a bit at a Web3 place. Went in with an open mind and now have opinions)

[1] https://x.com/Steve_Yegge/status/2043127887059210470


> someone else creates a coin named after him, offers him trading commission to talk about it and then makes money off the hype

And we are supposed to believe that someone deep in tech, in 2026, did not know this was going to be the end goal? Was $GAS supposed to be a crypto to help fund poor farmers in Burundi or something ? How else is the meme coin #16352813 supposed to end? That’s the entire point of meme coins.

Would love to also « get sucked » into making 300k$.


> Would love to also « get sucked » into making 300k$.

Exactly.

It seems harmless - "look, we have this token, it is being traded anyway, do you want to get some of the emissions?"

Who wouldn't say "yes" to that free money.

But it's not clear at all how corrupting the crypto scam is, and how subtly the corruption seeps into what you do. It starts by "oh can you just tweet out about this" and you are "sure - it's just a tweet" and slowly grows.

Steve Yegg deserves credit for walking away from it.


yeah its kind of sad, because people have to then re-evaluate others they heard about who they also didn't believe the apologies of at the time

like the Hawk Tuah girl, or the Enron relaunch long form comedy routine that wound up with a short lived crypto token, and pretty much anyone with 15 minutes of fame or celebrities that drop a contract address

for the most part, they themselves actually are the victims of a roving band of deployers running the crypto launch convincing them they're part of something, and of course, the consumers have the choice of never getting involved

but the deployers are the ones that should face some form of accountability, or at least the public eye


To me, no, not quite. I'll give him one free pass. More like "I'll coast on this pulled rug to see what happens" than that he did the rug pull. Not a very wise thing to do, but not malicious either.


The description on Wikipedia looks like somebody else created a memecoin in his honor, sent him the profits, and he accepted them? And the only people harmed were people who invest in random memecoins? I don't understand the problem.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: